http://ransomlookumjrc6erzqn467lkcu2t5h4enjzfigvsxrrktxicysi2yd.onion/group/blackmatter
BlackMatter targeted Windows and Linux/VMware ESXi systems, using ChaCha20 for file encryption with RSA-1024 public key protection. The malware appended a custom extension per victim and dropped ransom notes (README.txt) with Tor portal links. The group focused on large organizations in industries such as critical infrastructure, agriculture, technology, and manufacturing, but claimed to avoid hospitals, nonprofits, and government entities (though some reports contradict...